用贝叶斯采样提升成员推理攻击效率，仅需一个参考模型即可实现顶尖效果。
How does Bayesian Sampling help Membership Inference Attacks?
- 基于拉普拉斯近似对单个参考模型进行参数后验采样，直接估计条件得分分布。
- 相比传统方法，攻击准确率提升显著，且计算开销降低近90%。
- 适用于图像、文本、表格多类数据，特别适合资源受限场景。
成员推理攻击（MIA）旨在判断特定数据点是否被用于训练某个模型。现有最优攻击方法通常需要训练多个参考模型来逼近单个数据点的条件得分分布，导致显著的计算开销，限制了实际应用。本文提出一种新方法——贝叶斯成员推理攻击（BMIA），通过贝叶斯采样实现条件攻击。具体地，我们对单个参考模型使用拉普拉斯近似获得参数后验分布，从而直接估计条件得分分布。理论上证明，贝叶斯采样可降低模型内方差，提升攻击能力。这一洞察自然引出多参考模型变体，在有更多参考模型时进一步增强性能。在图像、文本和表格数据集上的大量实验表明，该方法在有效性和效率上均达到当前最佳水平。
原文摘要 · Abstract (English)
Membership Inference Attacks (MIAs) aim to estimate whether a specific data point was used in the training of a given model. Existing state-of-the-art attacks typically rely on training multiple reference models to approximate the conditional score distribution for individual data points, which leads to significant computational overhead and limits their practical applicability. In this work, we propose a novel approach -- Bayesian Membership Inference Attack (BMIA), which performs conditional attack through Bayesian sampling. Specifically, we apply Laplace approximation to a single reference model to obtain a posterior over model parameters, enabling direct estimation of the conditional score distribution. Theoretically, we demonstrate that Bayesian sampling reduces intra-model variance, thereby improving attack power. This insight naturally motivates the multi-reference variant that further enhances performance when additional reference models are available. Extensive experiments across image, text, and tabular datasets indicate that our method achieves state-of-the-art performance in both effectiveness and efficiency.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。